The vulnerabilities are located in the `New+ Text file` and `New+ Folder` function of the jdisk wifi application file manager web-interface.
Remote attackers are able to inject own system specific codes by manipulation of the folder- & file name value in the add procedure.
The code execution occurs in the main file dir index and sub category listing, the add new edit file but also in the the app status
notification message context. The security risk of the remote code execution vulnerabilities in the add new folder- & text file function
are estimated as critical with a cvss (common vulnerability scoring system) count of 9.4(+)|(-)9.5.

1.2
A directory-traversal web vulnerability has been discovered in the official sticktos jDisk v2.0.3 iOS mobile web-application.
The vulnerability allows remote attackers to unauthorized access system path variables or web-server data to compromise the application.

The local vulnerability is located in the `folderContent to folder` value of the mobile application. Remote attackers can exploit the bug
by usage of a manipulated GET method request to unauthorized access app/device paths or folders. The local issue is a classic directory-traversal
web vulnerability. The execution of the malicious dt string in the foldercontent to folder path request occurs in the context of the requested
interface page itself. The security risk of the directory traversal web vulnerability is estimated as high(-) with a cvss (common vulnerability
scoring system) count of 6.6(+)|(-)6.7.

1.3
A local file include web vulnerability has been discovered in the official sticktos jDisk v2.0.3 iOS mobile web-application.
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system
specific path commands to compromise the web-application or mobile device.

The web vulnerability is located in the `file name` value of the `Upload > Uplaod Files` module POST method request. Remote attackers
are able to inject own files with malicious filename to compromise the mobile application. The attack vector is persistent and the
request method is POST. The local file/path include execution occcurs in the main file dir index- or sub category item listing of
the file manager. The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability
scoring system) count of 8.3(+)|(-)8.4.

Exploitation of the local file include web vulnerability requires no user interaction or privileged web-application user account
with password. Successful exploitation of the local web vulnerability results in mobile application or connected device component
compromise by unauthorized local file include web attacks.

Proof of Concept (PoC):
=======================
1.1
The remote code execution can be exploited by remote attackers without privileged web-application user account or user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below.

1.2
The directory-traversal vulnerability can be exploited by remote attackers without user interaction or privileged web-application user account.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below.

1.3
The file include vulnerability can be exploited by remote attackers without user interaction or privileged web-application user account.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below.

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin (at) vulnerability-lab (dot) com [email concealed] or research (at) vulnerability-lab (dot) com [email concealed]) to get a permission.